Some of us may be very well aware of the classic tech support scam stories, where a man randomly calls people, and informs them that they are from "Windows company" and that the call recipient's computer has been detected full of viruses. These cold callers then use fake Blue Screen of Deaths, and make the victim think there really is something wrong with their PC.
Tactics like these can be easily terminated, with the use of a few built-in Windows tools, as well as a few keystrokes. However, scammers have been seen improving their game, and are now incorporating lock screens, in order to threaten a user even more.
This technique can be attributed to the infamous ransomware, where a malicious program encrypts a user's computer files, and sets a PC to be stuck on a lock screen prompting them to pay up.
As for this one, the scammers trick the victims into thinking that their Windows' license has expired, and then removes any ability for the user to control their computer. "This is not a fake browser pop up that can easily be terminated by killing the application or restarting the PC. No, this is essentially a piece of malware that starts automatically, and typical Alt+F4 or Windows key tricks will not get rid of it," according to Jérôme Segura of Malwarebytes Labs.
There is an entire ecosystem on how these malware are being distributed, one of which includes bundling them into Pay Per Install applications. "What you thought was a PC optimizer or Flash Player update turns out to be a bunch of useless toolbars and, in some cases, one of these lockers," said Segura.
A security researcher, @TheWack0lian has shared a sample on how the new tech support scam tactic works. Through a genuine-looking Microsoft program, which installs without any particular incident, the malware waits for the user to restart their system. Upon rebooting, a user will be welcomed by what looks like Windows configuring updates, though this is already the malware kicking in.
Once its "process" is done, it displays an error screen saying that the user's Windows license is expired. It even takes the time to display the user's current license key and computer name, to make it look more legitimate.
Now, to be able to unlock the system, the only choice a user has is to dial the number flashed on the screen, leading them into the said cold tech support scammers who are eager to steal victims' personal information, as well as their credit card number. Calling the number, it was discovered by the researchers that there is a hidden functionality to the locker. Pressing Ctrl+Shift+T will display an installer for TeamViewer, a remote access computer program. However, the scammer refused to proceed with unlocking the computer unless a payment of $250 is made.
Fortunately, the researchers were able to find a way to bypass the lock screen. Victims of the said issue can press Ctrl+Shift and then the S key. Alternatively, a user can enter either "h7c9-7c67-jb" or "g6r-qrp6-h2" or "yt-mq-6w" into the "Product Key" field to be able to unlock the PC. This however, might only work for some versions of the rogue program.
With these kinds of programs rapidly evolving right before our eyes, it is very alarming to see how much these kinds of malware can take many innocent and susceptible people hostage, and play on their fears in addition to stealing money from them.
It always pays to be wary of where we always go on the internet, as well as what links we click on. Also, a good security software is always handy, to be able to block out the malware that can possibly not only ruin our computers, but also possibly a part of our lives.
Source: Malwarebytes Blog via ZDNet | Images via Malwarebytes Blog
20 Comments - Add comment